CVE-2026-25648

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25648", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-04T05:15:41.792Z", "datePublished": "2026-02-23T21:01:21.600Z", "dateUpdated": "2026-02-25T15:17:46.508Z"}, "containers": {"cna": {"title": "Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/traccar/traccar/security/advisories/GHSA-mc2g-mjqh-8x78", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/traccar/traccar/security/advisories/GHSA-mc2g-mjqh-8x78"}], "affected": [{"vendor": "traccar", "product": "traccar", "versions": [{"version": ">= 6.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-23T21:01:21.600Z"}, "descriptions": [{"lang": "en", "value": "Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. The application accepts SVG file uploads without sanitization and serves them with the `image/svg+xml` Content-Type, allowing embedded JavaScript to execute when victims view the image. As of time of publication, it is unclear whether a fix is available."}], "source": {"advisory": "GHSA-mc2g-mjqh-8x78", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T15:17:20.340147Z", "id": "CVE-2026-25648", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:17:46.508Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25648", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-25T15:17:20.340147Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:17:37.288Z"}}], "cna": {"title": "Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload", "source": {"advisory": "GHSA-mc2g-mjqh-8x78", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "traccar", "product": "traccar", "versions": [{"status": "affected", "version": ">= 6.11.1"}]}], "references": [{"url": "https://github.com/traccar/traccar/security/advisories/GHSA-mc2g-mjqh-8x78", "name": "https://github.com/traccar/traccar/security/advisories/GHSA-mc2g-mjqh-8x78", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. The application accepts SVG file uploads without sanitization and serves them with the `image/svg+xml` Content-Type, allowing embedded JavaScript to execute when victims view the image. As of time of publication, it is unclear whether a fix is available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-23T21:01:21.600Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25648", "state": "PUBLISHED", "dateUpdated": "2026-02-25T15:17:46.508Z", "dateReserved": "2026-02-04T05:15:41.792Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-23T21:01:21.600Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "traccar", "vendor": "traccar", "versions": [{"status": "affected", "version": ">= 6.11.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*", "matchCriteriaId": "7A82295B-76FF-4917-A101-0DC8A2CC2612", "versionStartIncluding": "6.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. The application accepts SVG file uploads without sanitization and serves them with the `image/svg+xml` Content-Type, allowing embedded JavaScript to execute when victims view the image. As of time of publication, it is unclear whether a fix is available."}, {"lang": "es", "value": "Versiones del sistema de seguimiento GPS de c\u00f3digo abierto Traccar a partir de la 6.11.1 contienen un problema en el que usuarios autenticados pueden ejecutar JavaScript arbitrario en el contexto de los navegadores de otros usuarios al subir archivos SVG maliciosos como im\u00e1genes de dispositivo. La aplicaci\u00f3n acepta subidas de archivos SVG sin sanitizaci\u00f3n y los sirve con el Content-Type 'image/svg+xml', permitiendo que el JavaScript incrustado se ejecute cuando las v\u00edctimas ven la imagen. En el momento de la publicaci\u00f3n, no est\u00e1 claro si hay una soluci\u00f3n disponible."}], "id": "CVE-2026-25648", "lastModified": "2026-06-17T10:25:00.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25648", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T15:17:20.340147Z", "version": "2.0.3"}}]}, "published": "2026-02-23T21:19:10.690", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/traccar/traccar/security/advisories/GHSA-mc2g-mjqh-8x78"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.11.1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "traccar", "source": "cna", "vendor": "traccar"}, "product": "traccar", "vendor": "traccar"}], "analysis": {"en": {"generated_at": "2026-04-18T17:46:34.432843+00:00", "value": {"mitigation_remediation": ["Reconfigure Traccar to reject SVG uploads entirely or enforce a safe image type whitelist.", "Delete any existing SVG images that might contain malicious JavaScript from the upload directory.", "Check the Traccar project\u2019s release notes and download page to determine whether a patched version is available, and if so, schedule an upgrade.", "Apply a strict Content Security Policy that blocks inline script execution from image resources."], "summary": {"action": "Assess and Mitigate", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "Open\u2011source Traccar GPS tracking instances that are version 6.11.1 and newer are impacted if a fix has not yet been applied. Earlier releases prior to 6.11.1 are not affected, and versions that have received a patch are no longer vulnerable.", "description_and_impact": "Traccar allows authenticated users to upload SVG files that the system serves as image/svg+xml without sanitizing. The malicious SVG can embed JavaScript that executes when another user views the image, leading to arbitrary client\u2011side code execution in the victim\u2019s browser. This stored XSS flaw is classified as CWE\u201179 and CWE\u2011434.", "risk_and_exploitability": "The flaw scores a high CVSS of 8.7, yet the EPSS of less than 1% suggests a low field exploitation probability. It is not listed in CISA\u2019s KEV catalog, indicating no public exploit is known. Because the vulnerability requires authenticated file upload and a victim\u2019s interaction with the image, it mainly poses an internal risk for organizations that allow shared dashboards."}}}}, "created": "2026-02-24T09:54:49.951496+00:00", "updated": "2026-04-18T18:00:06.448858+00:00", "vendors": ["traccar", "traccar$PRODUCT$traccar"]}